Add capability to pass in certs dynamically from memory. (#60)

Author: eoinmcq

pkg/certificate/certificate.go

@@ -165,6 +165,33 @@ func GenerateSignedCert(ca *KeyPair, hostnames HostNames, commonName string) (*K
 	return &keyPair, nil
 }
 
+// GenerateSignedCertFromFiles generates a new signed certificate signed by the input CA key/cert pair.
+func GenerateSignedCertFromFiles(caCertFile string, caKeyFile string,
+	hostnames HostNames, commonName string,
+) (*KeyPair, error) {
+	cert, err := tls.LoadX509KeyPair(caCertFile, caKeyFile)
+	if err != nil {
+		return nil, fmt.Errorf("can't load certificate from `%s` because: %w", caCertFile, err)
+	}
+
+	// Get the certificate bytes (DER)
+	certBytes := cert.Certificate[0]
+
+	// Get the private key bytes (for RSA)
+	rsaKey, ok := cert.PrivateKey.(*rsa.PrivateKey)
+	if !ok {
+		return nil, fmt.Errorf("can't load private from `%s` because: %w", caKeyFile, err)
+	}
+	keyBytes := x509.MarshalPKCS1PrivateKey(rsaKey)
+
+	caKeyPair := &KeyPair{
+		Certificate: pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certBytes}),
+		PrivateKey:  pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: keyBytes}),
+	}
+
+	return GenerateSignedCert(caKeyPair, hostnames, commonName)
+}
+
 // GenerateCRL will generate a blank Certificate revocation List from the provided issuer certificate.
 func GenerateCRL(ca *KeyPair) ([]byte, error) {
 	tlsKeyPair, err := tls.X509KeyPair(ca.Certificate, ca.PrivateKey)

pkg/service/service.go

@@ -3,6 +3,7 @@ package service
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"net/http"
@@ -59,6 +60,7 @@ type MiddlewareHandler struct {
 type ServerCertificateConfig struct {
 	CertificateFile string // The TLS certificate file.
 	KeyFile         string // The TLS private key file.
+	Certificate     *tls.Certificate
 }
 
 // RateLimitConfig specifies the rate limiting config.
@@ -307,6 +309,16 @@ func (s *Service) Run() error {
 
 	go func() {
 		if s.config.CertConfig != nil {
+			var tlsConfig *tls.Config
+			if s.config.CertConfig.Certificate != nil {
+				tlsConfig = &tls.Config{
+					MinVersion:   tls.VersionTLS12,
+					Certificates: []tls.Certificate{*s.config.CertConfig.Certificate},
+				}
+			}
+
+			s.Server.TLSConfig = tlsConfig
+
 			err := s.Server.ListenAndServeTLS(s.config.CertConfig.CertificateFile, s.config.CertConfig.KeyFile)
 			if !errors.Is(err, http.ErrServerClosed) {
 				logrus.Fatalf("Failed to start query service: %s\n", err)